Hacking Notes
Ctrlk
  • Ports & Enumeration
  • Antivirus Evasion
  • Port Forwarding
  • Cloud
  • Word List Creation
  • Active Directory
    • Domain Enumeration
    • Domain Trusts
    • Domain Mapping
    • discretionary access control list (DACL)
    • MS SQL
    • gMSA
    • Exchange
    • Group Exploitation
    • Domain Exploitation
    • Kerberos Attacks
    • SCCM
    • NTDS dumping
    • Impacket
    • ADCS exploitation
    • Privilege Escalation
    • LAPS
  • AI Red Teaming
  • Cloud
    • Azure
    • G-Cloud
    • Enumeration
  • Web Application
    • Info
    • Log Poisoning / PHP Wrapping
    • HTTP Request Smuggling
    • Client Side Desync
    • Enumeration
    • Databases
    • SQL Injection
    • WebSocket
    • File Inclusion
    • Brute forcing
    • Cross Site Scripting (XSS)
  • Cracking
  • Wireless
  • DFIR
    • Forensics
    • Memory Analysis
    • ReverseEngineering
    • Mobile
  • Networking
    • Radio
    • Vlans & Wired networking
    • Network Access Control
    • IPV6
    • Wireless
    • Bluetooth
  • Misc
    • Shells
    • Buffer Overflow
    • Powershell
    • Random Bits
    • Phishing
    • Coding
    • Git
  • Command & Control
    • Meterpreter
    • Droppers
    • CobaltStrike
      • teamserver
      • Payload generation
        • Stagers
        • AV/EDR Bypass
          • Obfuscation
          • Sandbox Evasion
          • Win32 API
          • EDR Evasion
          • Encrypters
      • Listeners
      • Malleable Profiles
      • Initial Acces / Aggressors
      • Beacon Object Files (BOF)
      • Cheatsheet
    • Lateral Movement
    • Persistence
  • Mobile App Testing
    • IOS
Powered by GitBook
On this page
  1. Command & Control
  2. CobaltStrike
  3. Payload generation
  4. AV/EDR Bypass

Obfuscation

Targetted malware deployment:

LogoGitHub - Arvanaghi/CheckPlease: Sandbox evasion modules written in PowerShell, Python, Go, Ruby, C, C#, Perl, and Rust.GitHub

Obfuscate PowerShell scripts to replace key words

Certificate/Code Sign all apps

LogoGitHub - secretsquirrel/the-backdoor-factory: Patch PE, ELF, Mach-O binaries with shellcode new version in development, available only to sponsorsGitHub
LogoGitHub - secretsquirrel/SigThief: Stealing Signatures and Making One Invalid Signature at a TimeGitHub
LogoGitHub - Genetic-Malware/Ebowla: Framework for Making Environmental Keyed Payloads (NO LONGER SUPPORTED)GitHub

when writing code:

import ctypes as FuckAV

PreviousAV/EDR BypassNextSandbox Evasion

Last updated 2 years ago